CriticalPublic exploit

RCE in MGI/Roxio/iseemedia LPViewer ActiveX (LPControl.dll) via stack buffer overflow

IdentifiersCVE-2008-4384CWE-121

CVE-2008-4384 is a set of multiple stack-based buffer overflow vulnerabilities in the MGI Software LPViewer ActiveX control (LPControl.dll), later associated with Roxio and iseemedia. Remote attackers can trigger memory corruption by invoking exposed methods with crafted arguments—specifically the url, toolbar, and enableZoomPastMax methods—leading to stack overflow and potential arbitrary code execution in the context of the hosting process (commonly Internet Explorer when instantiated via HTML/ActiveX).

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Remote code execution is possible for an unauthenticated attacker if a victim is induced to load attacker-controlled HTML content that instantiates the vulnerable ActiveX control and calls the affected methods with malicious parameters. Successful exploitation yields code execution with the privileges of the current user; failed or partial exploitation may result in a crash of Internet Explorer or the hosting application (denial of service).

Mitigation

If you can’t patch tonight, do this now.

Disable the LPViewer ActiveX control in Internet Explorer by setting the kill bit for CLSID {3F0EECCE-E138-11D1-8712-0060083D83F5}. As an additional/alternative control, disable or restrict ActiveX controls in the Internet Zone to reduce exposure to malicious web content that could instantiate the control.

Remediation

Patch, then assume compromise.

No vendor patch is available per the referenced advisory. Remediation is to disable the vulnerable ActiveX control (e.g., via the Internet Explorer kill bit mechanism for the control’s CLSID) to prevent instantiation and exploitation.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

lpviewer_url.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module (lpviewer_url.rb) that exploits a stack buffer overflow vulnerability in the LPViewer ActiveX control (LPControll.dll 3.2.0.2) used by iseemedia, Roxio, and MGI Software. The exploit targets Windows XP and Vista systems running Internet Explorer 6 or 7 with the vulnerable ActiveX control installed. The module sets up a malicious HTTP server that serves a crafted HTML/JavaScript page. When a victim visits this page, the script instantiates the vulnerable ActiveX control and sets its URL property to a specially crafted, overly long string, triggering the buffer overflow and executing attacker-supplied shellcode. The payload is customizable via the Metasploit framework, allowing for various post-exploitation actions. The main fingerprintable endpoints are the LPControll.dll file and the LPViewer.LPViewer.1 ActiveX ProgID. The exploit is operational and requires user interaction (visiting a malicious page) to trigger.

Disclosed Oct 6, 2008rubybrowser

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

IseemediaLpviewerapplication

Mgi SoftwareLpviewerapplication

RoxioLpviewerapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity